fix: persist knowledge citations before chat finalization

.github/workflows/cicd.yml

@@ -739,6 +739,8 @@ jobs:
           max_attempts: 3
           retry_wait_seconds: 10
           command: |
+            set -euo pipefail
+
             VERSION="${{ needs.version-check.outputs.version }}"
 
             # Download binaries and calculate checksums
@@ -772,61 +774,64 @@ jobs:
             git commit -m "Update veryfront to v${VERSION}"
             git push -u origin "${BRANCH}" || git push -u origin "${BRANCH}" --force-with-lease
 
-            PR_NUMBER=$(GH_TOKEN="${HOMEBREW_TAP_TOKEN}" gh api \
+            export GH_TOKEN="${HOMEBREW_TAP_TOKEN}"
+            PR_NUMBER=$(gh api repos/veryfront/homebrew-tap/pulls \
               --method GET \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "/repos/veryfront/homebrew-tap/pulls?state=open&head=veryfront:${BRANCH}&base=main&per_page=1" \
+              -f state=open \
+              -f head="veryfront:${BRANCH}" \
+              -f base=main \
               --jq '.[0].number // empty')
 
             if [ -z "${PR_NUMBER}" ]; then
-              CREATE_PR_OUTPUT=$(GH_TOKEN="${HOMEBREW_TAP_TOKEN}" gh api \
-                --method POST \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "/repos/veryfront/homebrew-tap/pulls" \
-                -f title="Update veryfront to v${VERSION}" \
-                -f base="main" \
-                -f head="${BRANCH}" \
-                -f body="Automated update from CI - veryfront v${VERSION}" \
-                --jq '.number' 2>&1) || {
-                  if echo "${CREATE_PR_OUTPUT}" | grep -q "Resource not accessible by personal access token"; then
+              CREATE_PR_OUTPUT=$(gh pr create \
+                --repo veryfront/homebrew-tap \
+                --title "Update veryfront to v${VERSION}" \
+                --base main \
+                --head "${BRANCH}" \
+                --body "Automated update from CI - veryfront v${VERSION}" 2>&1) || {
+                  if echo "${CREATE_PR_OUTPUT}" | grep -Eq "Resource not accessible by (integration|personal access token)"; then
                     echo "::error::Homebrew tap update requires a GitHub App token with Pull requests: write and Contents: write on veryfront/homebrew-tap."
                   fi
                   echo "${CREATE_PR_OUTPUT}"
                   exit 1
                 }
-              PR_NUMBER="${CREATE_PR_OUTPUT}"
+
+              PR_URL=$(printf '%s\n' "${CREATE_PR_OUTPUT}" | tail -n 1)
+              PR_NUMBER="${PR_URL##*/}"
+              if ! [[ "${PR_NUMBER}" =~ ^[0-9]+$ ]]; then
+                echo "::error::Created Homebrew tap PR but could not read its number."
+                echo "${CREATE_PR_OUTPUT}"
+                exit 1
+              fi
             fi
 
             # GitHub can report mergeability as unknown immediately after PR creation or a force-push.
             MERGEABLE=""
             MERGEABLE_STATE=""
             for attempt in {1..24}; do
-              PR_JSON=$(GH_TOKEN="${HOMEBREW_TAP_TOKEN}" gh api \
-                --method GET \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "/repos/veryfront/homebrew-tap/pulls/${PR_NUMBER}")
+              PR_JSON=$(gh pr view "${PR_NUMBER}" \
+                --repo veryfront/homebrew-tap \
+                --json mergeable,mergeStateStatus)
               MERGEABLE=$(echo "${PR_JSON}" | jq -r '.mergeable')
-              MERGEABLE_STATE=$(echo "${PR_JSON}" | jq -r '.mergeable_state')
+              MERGEABLE_STATE=$(echo "${PR_JSON}" | jq -r '.mergeStateStatus')
 
-              if [ "${MERGEABLE}" = "true" ] && [ "${MERGEABLE_STATE}" = "clean" ]; then
+              if [ "${MERGEABLE}" = "MERGEABLE" ] && [ "${MERGEABLE_STATE}" = "CLEAN" ]; then
                 break
               fi
 
-              if [ "${MERGEABLE}" = "false" ]; then
+              if [ "${MERGEABLE}" = "CONFLICTING" ]; then
                 echo "::error::Homebrew tap PR #${PR_NUMBER} is not mergeable (state=${MERGEABLE_STATE})."
                 exit 1
               fi
 
               sleep 5
             done
 
-            if [ "${MERGEABLE}" != "true" ] || [ "${MERGEABLE_STATE}" != "clean" ]; then
+            if [ "${MERGEABLE}" != "MERGEABLE" ] || [ "${MERGEABLE_STATE}" != "CLEAN" ]; then
               echo "::error::Timed out waiting for Homebrew tap PR #${PR_NUMBER} to become mergeable (mergeable=${MERGEABLE}, state=${MERGEABLE_STATE})."
               exit 1
             fi
 
-            GH_TOKEN="${HOMEBREW_TAP_TOKEN}" gh api \
-              --method PUT \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "/repos/veryfront/homebrew-tap/pulls/${PR_NUMBER}/merge" \
-              -f merge_method="merge"
+            gh pr merge "${PR_NUMBER}" \
+              --repo veryfront/homebrew-tap \
+              --merge

cli/mcp/tools/deploy-tool.test.ts

@@ -329,7 +329,11 @@ describe("mcp/tools/deploy-tool", () => {
         const mismatchResult = await withMockFetch(handleRequest, runDeploy);
 
         assertEquals(mismatchResult.success, false);
-        assertEquals(mismatchResult.error?.includes("does not match pushed commit"), true);
+        assertEquals(
+          mismatchResult.error?.includes("does not match pushed commit"),
+          true,
+          mismatchResult.error,
+        );
         assertEquals(
           capturedRequests.map(({ method, url }) => `${method} ${new URL(url).pathname}`),
           [
@@ -470,5 +474,36 @@ describe("mcp/tools/deploy-tool", () => {
         }
       }
     });
+
+    it("does not treat 401 digits embedded in another error as an auth failure", async () => {
+      const originalToken = Deno.env.get("VERYFRONT_API_TOKEN");
+      const sourceError =
+        "Release rel-42 source does not match pushed commit abc401def0000000000000000000000000000000";
+      try {
+        Deno.env.set("VERYFRONT_API_TOKEN", "test-token-abc");
+
+        const result = await withMockFetch(
+          async () =>
+            Response.json({ error: "release_mismatch", message: sourceError }, {
+              status: 500,
+            }),
+          async () =>
+            await triggerDeploy({
+              projectSlug: "my-app",
+              environment: "production",
+              branch: "main",
+            }),
+        );
+
+        assertEquals(result.success, false);
+        assertEquals(result.error, sourceError);
+      } finally {
+        if (originalToken !== undefined) {
+          Deno.env.set("VERYFRONT_API_TOKEN", originalToken);
+        } else {
+          Deno.env.delete("VERYFRONT_API_TOKEN");
+        }
+      }
+    });
   });
 });

cli/mcp/tools/deploy-tool.ts

@@ -159,11 +159,14 @@ export async function triggerDeploy(
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
+    const status = typeof error === "object" && error !== null
+      ? (error as { status?: unknown }).status
+      : undefined;
 
     if (
       message.includes("Missing API token") ||
       message.includes("Authentication required") ||
-      message.includes("401")
+      status === 401
     ) {
       return {
         success: false,

deno.json

@@ -1,11 +1,12 @@
 {
   "name": "veryfront",
-  "version": "0.1.1132",
+  "version": "0.1.1133",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "minimumDependencyAge": {
     "age": "P2D",
     "exclude": [
+      "npm:brace-expansion",
       "npm:esbuild",
       "npm:@esbuild/aix-ppc64",
       "npm:@esbuild/android-arm",